This article covers the program Windows Photo Gallery and analysis
of data file typically titled pictures.pd4 file and how to extract the content
for review.
Windows Photo Gallery (WPG) is a multimedia management tool developed
by Microsoft and comes installed as part of the Microsoft Windows Vista
operating system. It is accessible from the Start menu under 'Programs'.

WPG allows you to batch preview photo and video content as a series of
thumbnails serving as an electronic photo album.
A user can add additional information or 'tags' to each entry including
comments, ratings and other descriptive information.

The above picture shows WPG running and previewing both video and picture
files. New files are added from the menu option 'Add Folder to Gallery'. Files
can be previewed by tag, date or by rating, views can be filtered to show only
picture, video or both.

The information generated when a user has previewed files using WPG is written
to disk in a single file, this is typically titled 'pictures.pd4', one file exists for each
profile on the computer in the following location:

VOLUME\Users\PROFILE\AppData\Local\Microsoft\Windows Photo Gallery

The WPG data file can be readily examined using the tool WPG Viewer a forensic software tool which is part
of the Simple Carver Suite and is capable of reading the 'pictures.pd4' file.